Re:I think tumblr has a huge security hole
by KevBurnsJr on Saturday March 19, 2011 @10:56AM
(#2343727)
Actually, PHP returns a 200 when it encounters a fatal error.
This explains why it was indexed by Google.
The hitch was of course that the file in question had a "i?php" (someone was using vi and hit i too many times?) instead of "<?php" which lead the php interpreter to output that section of code as if it were HTML. That feature is something PHP could provide an option to disable and only allow explicit echo/print/printf which should be what templating engines use.